Abstract: A method and apparatus is disclosed herein for dynamically scaling application performance analysis completeness based on available system resources. In one embodiment, the method comprises monitoring incoming network traffic and a rate at which the traffic is being analyzed and dynamically adjusting application performance analysis completeness, the analysis being performed on the observed network traffic.

Abstract: A method and apparatus for dynamic host operating system firewall configuration provides plural monitoring processes to monitor the firewall configuration of a host operating system and guest operating systems. When any firewall configuration change is detected by a monitor in a monitored guest operating system, an appropriate corresponding firewall change is made by the monitor to the host operating system.

Abstract: There is provided a template stack that receives data from a plurality of nodes in a communication network. The template stack maps the received data to a common data framework and receives a template request from a client node. The template request preferably includes at least one transform function. In response to receiving the template request, the template stack performs the at least one transform function on the data to yield transform data and transmits the transform data to the client node.

Abstract: Network monitoring method and apparatus determines the zero window event data transfer delay, reporting the amount of data transfer delay caused thereby. Non-data-transfer-delaying zero window events can be separated from those causing actual delay, allowing reporting of actual delay events separate from non-delay causing events.

Abstract: A method and apparatus is disclosed herein for dynamically scaling application performance analysis completeness based on available system resources. In one embodiment, the method comprises monitoring incoming network traffic and a rate at which the traffic is being analyzed and dynamically adjusting application performance analysis completeness, the analysis being performed on the observed network traffic.

Abstract: A method and apparatus to estimate application and network performance metrics and distribute those metrics across the appropriate applications, sites, servers, and the like, performs shallow analysis on a majority of traffic and deep analysis on a sampled set of the traffic, and estimates network and application performance metrics for the non-deep analysis data, providing an overall estimate of metrics without requiring deep analysis of all traffic.

Abstract: Network monitoring method and apparatus determines the zero window event data transfer delay, reporting the amount of data transfer delay caused thereby. Non-data-transfer-delaying zero window events can be separated from those causing actual delay, allowing reporting of actual delay events separate from non-delay causing events.

Abstract: Network traffic is distinguished at a conversation level, providing sampling decision capability. A hash value is determined based on IP addresses and protocol type, giving unique identifiers for individual conversations.

Abstract: Data storage rates are dynamically adjusted in an APM system, by monitoring data storage elements and modulating the data storage when a determination is made that the storage buffer utilization is too high.

Abstract: A method and apparatus for dynamic host operating system firewall configuration provides plural monitoring processes to monitor the firewall configuration of a host operating system and guest operating systems. When any firewall configuration change is detected by a monitor in a monitored guest operating system, a appropriate corresponding firewall change is made by the monitor to the host operating system.

Abstract: Data acquisition rates are dynamically adjusted in an APM system, by monitoring data acquisition hardware and reducing the data acquisition rate when a determination is made that the data rate is too high for processing by an APM.

Abstract: A network analyzer reads network packets and extracts characterizing attributes, grouping patents observed in a given amount of time on common attribute values. Grouped attributes are meta data, written to a database, while packets are written to files.

Abstract: A network analyzer reads network packets and extracts characterizing attributes, grouping patents observed in a given amount of time on common attribute values. Grouped attributes are meta data, written to a database, while packets are written to files. Meta data is stored in the database including links to the physical packets related to the meta data, and a user interface enables query of the meta data and retrieval of related physical packets.

Abstract: Bounding of large queries is provided in a network analysis environment by receiving a user query of a data set of network transactions, submitting a meta data query to the data set to determine whether the query would require an unreasonable amount of time to complete, and notifying the user to re-formulate the query if it would require too much time.

Abstract: Discrimination of application specific network traffic from other from general or unclassified network traffic is provided. Users may specify particular applications or data strings to be monitored.

Abstract: A system includes a plurality of distributed network analyzers, each of the distributed network analyzers configured to receive and filter network traffic from a single network link under test so that the network traffic is distributed across the plurality of distributed network analyzers and to capture data from the filtered network traffic. The system also includes a processing device receiving the captured data from the each of the plurality of distributed network analyzers, wherein the processing device includes software configured to interleave the received data to form a single stream of data from network traffic on the network link under test.

Abstract: A test and measurement system having two measurement systems. A first measurement system that monitors communication in a signaling protocol, while a second measurement system that monitors communication in a network protocol. A correlation system correlates the output of the first measurement system with the output of the second measurement system. A graphical user interface generates a display comparing at least one aspect of the output of the first measurement system with at least one aspect of the second measurement system based on the output of the correlation system.

Abstract: Methods and systems for assigning participant identifying data to network transmission events. Participant identifying data and identifying data related to a network transmission event are provided to a predetermined (also referred to as central) monitoring location and stored in a database at the central monitoring location.

Abstract: Methods and systems for coordinated monitoring of network transmission events. Predetermined information for the network transmission event is obtained at a first network location and the network transmission event predetermined information is provided to a predetermined monitoring location (or server). From the predetermined monitoring location, the predetermined information is provided to other network monitoring devices at one or more other network locations. At the one or more other network locations, the network transmission event, corresponding to the predetermined information obtained at the first location, is monitored. Network transmission event information, corresponding to the predetermined information obtained at the first location, is provided to the predetermined monitoring location from the first location and the other network locations. The monitoring of network transmission can be thereby coordinated.

Abstract: Methods and system for analyzing a number of data streams collected at an arbitrary point in a network. In an embodiment of the method of this invention, one or more transmission messages are acquired, the transmission messages being transmitted over a network according to a predetermined protocol. The one or more acquired transmission messages are provided to a state machine.